# PhishDestroy domain threat record: nasanenc.co.kr Content language: English Canonical HTML report: https://phishdestroy.io/domain/nasanenc.co.kr/ Machine-readable companion: https://phishdestroy.io/domain/nasanenc.co.kr/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-04 15:40:55 UTC - Last availability or vendor check: 2026-10-22 10:30:39 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 172.67.198.171 - Registrar in stored WHOIS data: viaweb(http://viaweb.co.kr) - Last stored HTTP status: 200 - Registration date (registry RDAP, nasanenc.co.kr): 2026-08-31 15:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06d12-319f-748d-8758-33d4eb6cfe1f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/nasanenc.co.kr - Certificate Transparency search: https://crt.sh/?q=%25.nasanenc.co.kr - Web Archive lookup: https://web.archive.org/web/*/https://nasanenc.co.kr/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview nasanenc.co.kr is an impersonation phishing page that presents itself as 나산이엔씨 (Nasan E&C), a Korean manufacturer of air circulators and air-conditioning units. Its .co.kr address and Korean-language title are built to look credible to buyers, suppliers and partners in Korea. PhishDestroy first flagged it on 2026-09-04, and on 2026-10-19 the site was still online and serving content. How the scam works The page title reads "나산이엔씨 | 공기순환기 · 공기조화기 제조" ("Nasan E&C | air circulator and air conditioner manufacturing"), which is an ordinary industrial company profile. We classified the site as impersonation phishing. Schemes like this borrow a real company's name to win trust. They then steer visitors toward handing over login credentials, contact and payment details, or paying fake invoices and orders. Because it appears on MetaMask and SEAL blocklists, crypto users should be especially wary of any request to connect a wallet or enter a recovery phrase here. Evidence Detection is still thin. Only 5 of 92 VirusTotal engines flagged the domain as of 2026-10-19: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. Stronger confirmation comes from inclusion on the PhishDestroy, MetaMask and SEAL blocklists, which are the lists wallet software actually checks. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers have independently tracked it. Infrastructure The domain was registered on 2026-09-01 through the Korean registrar viaweb and was caught just three days later. A freshly registered lookalike that is caught this quickly fits a throwaway phishing setup. It sits behind Cloudflare, which hides the real origin server, and the IP resolves to Canada. Its certificate from Google Trust Services (WE1) is issued automatically, so the padlock in the browser says nothing about who runs the site. What to do Do not enter passwords, company details or payment information on this site, and never type a wallet recovery phrase into it. If you logged in with credentials you also use elsewhere, change those passwords and enable two-factor authentication. If you paid an invoice or order through it, contact your bank right away and verify any deal with Nasan E&C through a contact channel you already trust. Security teams should block the domain at DNS and proxy level and add it to mail filters. Report sightings to the registrar and to Cloudflare's abuse channel to support takedown. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06d12-319f-748d-8758-33d4eb6cfe1f/ VirusTotal report: https://www.virustotal.com/gui/domain/nasanenc.co.kr Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=nasanenc.co.kr Archived copy: https://web.archive.org/web/20260917093900/https://nasanenc.co.kr/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:50:28 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Lhv4XLLc/590938b49321.png Captured: 2026-09-04 15:40:55 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06d12-319f-748d-8758-33d4eb6cfe1f.png Captured: 2026-09-04 15:40:55 UTC Source report: https://urlscan.io/result/01a06d12-319f-748d-8758-33d4eb6cfe1f/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/abf439fc-628d-4a66-9d5a-939557ac3286.png Captured: 2026-09-04 15:52:13 UTC Source report: https://radar.cloudflare.com/scan/abf439fc-628d-4a66-9d5a-939557ac3286 SHA-256: ee2c3925c134526a674c3555edd34a69db07f95771f2a23da15884943c8d7029 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:52:02Z", "uuid": "01a06d12-319f-748d-8758-33d4eb6cfe1f", "scanned_at": "2026-09-04T15:40:41Z", "final_url": "https://nasanenc.co.kr/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://nasanenc.co.kr/", "from": "http://nasanenc.co.kr/", "status": 307 } ], "ip": "104.21.68.213", "domains": [ "cdn.jsdelivr.net", "static.cloudflareinsights.com" ], "ips": [ "104.16.79.73", "104.17.207.5", "104.21.68.213" ], "asns": [ "13335" ], "link_domains": [ "map.naver.com" ], "doc_hash": "c4a0ed6f7dc7a35fc6de0cb224d5331fbd8a5339ca31fdd5ef5cdc23415f1935", "script_hashes": [ "833567d505fed696beed49ecf5ff70ea1f2b838f0c8f64c1b8d2b5564a68e343", "2c752a401191671d5bbbe7514f5828bbb0a7cc50bfbe77ddaf1b1ccba4412ed2", "0e25d0f71231e99267806b8aabf7a7810982bccb561d1ec7df7e6eaa60e4e530", "244110cf05d0352fbe5a3e0b53b14559113a09493cbf2d557493249c92072680", "9541ff3dd96091ca8bebc305fb72eca68e6015a177e1d3b4aa72859dc52fbdd7", "9c92d1d1d0d59a7922dbfe96a1af501f4ef961501b9064c9b7d0f9e8e74f47bf", "a7ebb54bb691391656f8b0922c313ae11b89d6c93f887d96e02190e8a7aa5983", "1fd0f50b54b27ce6248cae3092b2d38b5c85e387e1a57505ddc01e93576ce100" ], "globals": [ "__next_f", "webpackChunk_N_E", "next", "_N_E_STYLE_LOAD", "__cfBeacon" ], "tls": { "san": [ "nasanenc.co.kr", "*.nasanenc.co.kr" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "nasanenc.co.kr", "protocol": "QUIC", "valid_to": "2026-12-01T12:26:48Z", "valid_from": "2026-09-02T11:26:53Z" }, "domain_age_days": 2, "apex_age_days": 2, "tls_age_days": 2, "tls_valid_days": 90, "requests": 24, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 80, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:02:12Z", "uuid": "abf439fc-628d-4a66-9d5a-939557ac3286", "scanned_at": "2026-09-04T15:52:13Z", "final_url": "https://nasanenc.co.kr/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://nasanenc.co.kr/", "status": 307 }, { "url": "https://nasanenc.co.kr/", "status": 200 } ], "dom_hash": "2b5e18006e8b6312f2b3691f0ccc52fc68eceed91a20b0388f102923e3e69015", "doc_hash": "e318c84d6699371e6314f953d5a7e9548b421ad3bad43f80816bb79e44a9cae6", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "nasanenc.co.kr", "type": "A", "value": "172.67.198.171" }, { "name": "nasanenc.co.kr", "type": "A", "value": "104.21.68.213" }, { "name": "nasanenc.co.kr", "type": "AAAA", "value": "2606:4700:3036::ac43:c6ab" }, { "name": "nasanenc.co.kr", "type": "AAAA", "value": "2606:4700:3031::6815:44d5" } ], "dnssec_valid": false, "ip": "172.67.198.171", "whois": { "registrar": "viaweb(http://viaweb.co.kr)", "created": "2026-09-01T00:00:00Z", "updated": "2026-09-02T00:00:00Z", "expires": "2027-09-01T00:00:00Z", "nameservers": [ "serenity.ns.cloudflare.com", "simon.ns.cloudflare.com" ] } } } ```